Advisories » MGASA-2024-0226

Updated iperf packages fix security vulnerability

Publication date: 17 Jun 2024
Modification date: 17 Jun 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-26306

Description

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with
RSA authentication, allows a timing side channel in RSA decryption
operations. This side channel could be sufficient for an attacker to
recover credential plaintext. It requires the attacker to send a large
number of messages for decryption, as described in "Everlasting ROBOT:
the Marvin Attack" by Hubert Kario.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=33296
• https://lists.suse.com/pipermail/sle-updates/2024-June/035556.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26306

SRPMS

9/core

• iperf-3.17.1-1.mga9